Special controls for handling sensitive data may be required if an RFP/solicitation includes any of the following references:
- Controlled Unclassified Information (CUI), Controlled Technical Information (CTI), Controlled Defense Information (CDI)
- 32 CFR Part 2002 - Controlled Unclassified Information (CUI)
- NIST SP 800-171 – Protecting Controlled Unclassified Information in Nonfederal Systems and Organization
- FAR Clause 52.204-21 – Basic Safeguarding of Covered Contractor Information Systems
- DFARS Clause 252.204-7008 – Compliance with Safeguarding Covered Defense Information Controls
- DFARS Clause 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting
- Cybersecurity Maturity Model Certification (CMMC)
The Sponsored Programs Office (SPO) will also review the RFP/solicitation, and award documentation for references to any of the above indicators of required data controls. Please make sure that you include a copy of the RFP in your Kuali proposal, or send a copy directly to SPO and your departmental proposal development specialist to assist them in their review for potential CUI.
Once a project is identified as involving CUI or other restricted data, the PI must determine whether a project is compatible with the Research Enclave. To do this, review the Determining Project Compatibility with the USU Research Enclave guide.